FreeRDP EUVD-2026-106993

Exploitation requires the victim's FreeRDP 3.32.0 client to establish a session with an attacker-controlled, compromised, or MITM'd RDP server (hence UI:P - user-initiated connection), and the drdynvc dynamic virtual channel path must be exercised. The specific trigger is a Virtual Channel PDU whose totalLength is smaller than the chunk size, causing a pool-owned stream to be freed with the owned-stream deallocator. Limiting factors: the attacker cannot reach a passive victim unsolicited - the client must connect outbound to the malicious endpoint; impact is confined to a client crash (denial of service) with no confirmed confidentiality or integrity loss; and the issue is tied to FreeRDP version 3.32.0 specifically.

This is a memory-corruption bug (CWE-416 use-after-free) whose real-world impact is bounded to denial of service, not code execution: the provided CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) sets VC:N/VI:N with only VA:H, and the description explicitly states the result is a client crash during teardown. The 7.1 score is driven entirely by that availability impact combined with network reach (AV:N) and no authentication (PR:N), but it is tempered by UI:P - the victim must actively connect to an attacker-controlled or compromised RDP server, so this is a client-side drive-you-to-a-bad-server bug, not a server-side wormable flaw. No EPSS score was provided, the CVE is not on CISA KEV, and no public exploit was referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuine but moderate-priority issue - patch it as part of normal RDP-client hygiene, but it does not carry the urgency of an RCE or an actively exploited flaw. Note one nuance to verify: despite AV:N, exploitation is only meaningful when the victim's FreeRDP client connects outbound to a malicious server, which is why UI:P is present; treat 'network' here as 'the attacker controls the remote endpoint,' not 'attacker reaches the victim unsolicited.'

An attacker stands up a malicious RDP server (or compromises/MITMs a legitimate one) and lures a user to connect with FreeRDP 3.32.0. During the session the server sends a single well-formed Virtual Channel PDU whose totalLength is smaller than the chunk size, causing the drdynvc channel to free a pool-owned stream with the wrong (owned-stream) deallocator, crashing the client at teardown. No public exploit code was referenced in the available data; impact is limited to denial of service of the client.